n8n-nodes-task-runner@1.0.0

Analysis

n8n-nodes-task-runner@1.0.0 is a trojanized n8n community node package. On require(), its index.js executes an IIFE that performs extensive host reconnaissance: hostname, user identity, network configuration, environment variables filtered for API keys/tokens/secrets/n8n/docker credentials, listening ports, Docker socket access, mounts, cgroups, capabilities, process list, crontab, and n8n-related files. It then scans the Docker bridge subnet 172[.]17[.]0[.]0/24 on ports 80, 443, 8080, and 5678 for open containers. All collected data is exfiltrated via TCP to 103[.]27[.]109[.]184:8892. A reverse shell is also established to the same IP:port. The package's TaskRunnerNode.js is a decoy node class with an empty execute method. The C2 endpoint is 103[.]27[.]109[.]184:8892.